Ripple Cannot Freeze 83 Million Dollars in Stolen XRP: What to Check in Custody and Deposits

When coins are stolen, it is not a company's goodwill that decides whether the proceeds can be frozen. It is the way the token was built. The past few days have shown that with unusual clarity. The attacker who drained assets worth hundreds of millions of dollars from the trading platform Bitget was able to move roughly 83 million dollars in XRP without obstruction. Ripple has no instrument against it. Stablecoins were a different story: there the issuers stepped in, but only for a vanishingly small share of the total.

For you as a holder, that raises a question worth answering before your next purchase: which of your holdings could anyone freeze at all, and who would that be? The answer differs for native coins and issued tokens, and it differs again between self-custody and an exchange account. This piece sorts out the technology, sets out the practical consequences, and shows where an account freeze also hits investors who had nothing to do with the theft.

What has happened since Thursday: 103 million XRP across five accounts

According to the company, assets were transferred to addresses controlled by the attacker at Bitget on Thursday, September 24, 2026. The damage figure has been revised upwards several times. The first estimate stood at 351.6 million dollars, shortly afterwards the figure quoted was 388 million, and on Friday the company named 387.5 million dollars. The platform attributes the increase to further transfers in Zcash and on Tron found while tracing the transactions, not to a second wave of attacks. We deliberately leave that range of 351.6 to 387.5 million dollars unsmoothed here, because it shows how uncertain the numbers are in the first days after an incident.

The XRP formed a block of their own. Just under 103 million XRP were withdrawn on Thursday and distributed across five accounts, according to CoinDesk. The movement began on Saturday. At 04:32 UTC, around 70 million tokens were still sitting in the original five accounts; roughly eight hours later the figure was 49 million. Two accounts that had previously held 20 million XRP each were left with about 23 and 55 tokens respectively, a third with 5.8 million.

The arithmetic behind that is easy to follow. At an XRP price of 1.54 dollars, as quoted by CoinGecko on September 27, 2026 at 12:49 UTC, the roughly 54 million tokens that moved correspond to about 83 million dollars, and the remaining 49 million tokens to around 75 million dollars. Both figures match the numbers CoinDesk published on Saturday.

Why Ripple cannot freeze native XRP

The decisive statement sits in the XRP Ledger's own technical documentation, and it leaves no room for doubt: "No one can freeze XRP in the XRP Ledger." The documentation adds that addresses cannot be made to surrender XRP, and that a network-wide freeze does not apply to XRP at all.

The reason lies in the token's role. XRP is the network's native asset, comparable to the role Ether plays in the Ethereum network. Native assets have no issuer who could lock a position after the fact. The XRP Ledger's freeze functions are aimed exclusively at issuers of tokens built on top of that network.

Individual Freeze, Global Freeze and No Freeze: the three switches in the XRP Ledger

The documentation describes three settings, and all three apply only to issued tokens:

• Individual Freeze: an issuer freezes the trust line to one specific counterparty. That counterparty can then no longer reduce its holding, except by paying it back directly to the issuer.
• Global Freeze: the issuer freezes all tokens it has issued, across every counterparty at once.
• No Freeze: the issuer permanently gives up the ability to freeze individual counterparties. A network-wide freeze remains available, but can never be switched off again afterwards.

Anyone reading that list spots the gap immediately. All three switches presuppose an issuer. XRP has none, so none of them applies. This is not negligence on Ripple's part but a property of the network, documented for years and applying to every holder alike, including you.

Native coins versus issuer tokens: the dividing line that decides whether a freeze is possible

In practice you only need one distinction. A native coin is the base asset of a network: Bitcoin on the Bitcoin network, Ether on Ethereum, XRP on the XRP Ledger, SOL on Solana. Nobody here holds a switch that could lock someone else's balance. An issuer token, by contrast, is a contract that a company or a program issues on somebody else's network. That includes the large stablecoins, tokenised securities and much of what trades under the heading of real world assets.

With issuer tokens, control sits with the issuer, and how far it reaches is written into the respective contract. Tether and Circle can place addresses on a blocklist. On Solana, certain token standards allow a freeze authority to be set that immobilises balances and in some cases claws them back. Whether a token carries that function is part of its contract data and can be checked before you buy.

The result is an uncomfortable double finding. The very property that protects your coins from outside access removes any prospect of a technical recovery if they are stolen. And the very property that makes recovery possible hands a company the power to immobilise your regular balance too. Both are the same function, seen from two directions.

What Circle and Tether actually achieved

In the Bitget case the stablecoin issuers did act. According to the available reports, Circle and Tether froze around 320,000 dollars in USDC and USDT that could be attributed to the incident. That number is the real lesson of the case: measured against damages of 387.5 million dollars, 320,000 dollars is less than one tenth of a percent.

That is not down to any reluctance on the issuers' part but to which assets the attacker held. Anyone moving proceeds in native coins is beyond the reach of this instrument. Bitget itself stated that its own protection fund covers the loss and that customer balances remain untouched. That is a corporate commitment, not a technical recovery.

Self-custody means nobody freezes anything, including for you

The obvious conclusion is to take coins off the exchange. That solves one problem and creates a second. In self-custody on your own hardware wallet, no company has access to your keys. No platform can lock your balance, no custodian's insolvency drags it down, no blocklist reaches you.

The price sits in the same line. If someone takes your keys, there is no authority that stops the process. There is no customer service, no protection fund and no issuer to freeze an address. With native coins the loss is final once the transaction is confirmed. Anyone choosing this route takes on the role the custodian fills at an exchange, along with every duty attached to it. Which devices come into question and how they differ is set out in our hardware wallet comparison.

The sensible answer is therefore rarely one extreme or the other, but a split by purpose. Holdings you intend to keep for a longer period belong in self-custody. Amounts you trade with at short notice stay where you need them. And how you secure your recovery words ultimately decides both.

When flagged coins land in your account: the freeze also hits bystanders

This point is regularly overlooked in the coverage, and it affects you directly. While nobody can lock native coins on the network, a trading platform can certainly lock an account into which such coins arrive. That is the lever that bites when it matters: an exchange receiving stolen XRP can restrict the receiving account and block withdrawals. The platform cannot stop the coins while they sit in the perpetrator's wallet, but it can close the exit as soon as somebody tries to turn them into money.

The catch is that at that moment the platform can only see that funds with a suspicious origin have arrived. Whether you are the perpetrator or a buyer who acquired the coins unwittingly in a peer-to-peer deal is only established later. Until then your account stands still, along with every other holding in it. European anti-money-laundering rules and the due diligence duties under the MiCA crypto regulation oblige providers to follow up such signals, and in case of doubt they do so quickly.

How to spot a problematic origin before you buy

As a private investor you cannot carry out a full check of provenance, but a few reliable indicators exist. Peer-to-peer deals with strangers outside regulated platforms are the main route by which flagged funds reach private hands. A noticeable discount to the exchange price is a warning sign, not a bargain, because nobody sells below the market price without a reason. If pressure to settle the matter quickly is added on top, the deal belongs cancelled.

Buying through a platform licensed in the EU shifts that check to the provider. That is the practical advantage of a licence, rarely visible day to day and decisive when something goes wrong. Which providers operate under supervision is listed in our overview of regulated crypto exchanges.

What MiCA demands of custodians, and what it does not deliver

Since the European MiCA regulation came fully into force, providers that hold customer assets in custody or offer trading need a licence. That brings obligations to segregate customer holdings from a firm's own assets, to organise custody properly, and to be liable for losses arising from the operation of the platform.

What MiCA does not do is change the technology of the networks. The regulation gives no authority and no company the ability to stop native coins after the fact. What it governs is how a provider must handle your balance while it holds it. Once the funds have left, supervisory and civil law apply, but no technical switch does.

A second distinction matters for context. The statutory deposit guarantee that protects bank balances up to 100,000 euros per customer and institution does not apply to crypto assets. It presupposes deposits held at a credit institution. Anyone with coins sitting at a trading platform holds a claim against that company, not a protected deposit.

An exchange protection fund: a promise, not deposit insurance

In the current case Bitget points to its own protection fund. Such funds are common in the industry and have genuinely held up in individual cases. Legally they are a voluntary commitment by the company. Size, composition and payout conditions are determined by the provider itself, there is no state supervision of these funds, and as a rule no individual customer gains an enforceable claim from them.

That is no blanket warning, but it is a question to ask before opening an account: how large is the fund relative to the customer assets held, how transparently does the provider disclose it, and in which assets does it hold it? A fund consisting largely of the platform's own token loses value precisely when it is needed. If a provider publishes neither size nor composition, the commitment is not verifiable for you, and you should weigh it accordingly.

Tax and reporting: what counts after a theft

If an incident hits you directly, the question shifts from technology to documentation. What matters to the tax office is whether and how you can evidence the loss. Which records are required and what treatment is realistic is set out in our piece on stolen coins and the tax evidence you need.

Independently of that, one rule holds: secure the records while they are still available. Platform statements, transaction IDs for the affected transfers, the receiving addresses and your correspondence with the provider. After an incident, interfaces get rebuilt and histories get shortened, and what you can export today may no longer be retrievable in a few weeks. A file export beats a screenshot, because it carries the identifiers in machine-readable form.

The Bitget withdrawal schedule: which dates apply to remaining balances

For anyone with a balance there, the timetable is the most concrete piece of information in the case. The company is reopening withdrawals in stages rather than all at once. Bitcoin withdrawals go first on September 28, Ether follows across the supported networks on September 29, and USDT on September 30. The remaining tokens, fiat services and peer-to-peer trading are due back by October 2.

In practice that means checking, on each date, whether a small test withdrawal goes through before you instruct a larger amount. Expect delays in the first few hours, because many users will be withdrawing at the same time. And record when you placed which instruction. We set out the details of the process and its stages when the resumption of withdrawals was announced.

What this case says about the months ahead

Two developments are taking shape. The first concerns stablecoins. The more often issuers freeze addresses, the more visible their role as a control point becomes, and the more pressing the question of the rules under which they do it. For holders that is a conflict of aims: the same function that helps after a theft is a day-to-day risk to your own balance.

The second concerns the trading venues. Because attackers are visibly switching to native coins, the defence moves to the entrances and exits, which is to say to the platforms. Expect tighter checks on deposits and more provisional account freezes. For you as a legitimate user, that means one thing above all: the route by which you acquire coins is becoming more important than the price you get them at.

Stolen coins and the limits of freezing: what to take away

1. Sort your holdings by design. Native coins such as Bitcoin, Ether or XRP cannot be frozen by anyone, while issuer tokens such as USDT and USDC certainly can. Note down, for each position, who could act in an emergency, and choose your custody route accordingly. For self-custody, the suitable devices are in our hardware wallet comparison.
2. Buy where somebody else carries out the provenance check. A discounted peer-to-peer deal saves a few percent and can immobilise your account for weeks if flagged funds are in it. Which providers operate under supervision in the EU is set out in the overview of regulated crypto exchanges.
3. Test your custodian's promises before you need them. Protection funds are voluntary commitments with no deposit insurance behind them, and MiCA governs how your balance is handled, not the technology of the networks.

Further reading: the XRP Ledger's technical documentation on its freeze functions, and the CoinDesk report on the movement of the stolen XRP.

(As of September 27, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)